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1. A method of using a computer equipped with a relational database to 
provide control output to address the throats confronting a system or 
organisation, comprising tho steps ot 

creating a series of relational database mitiltos which describe the 

system; 

analysing the system to derive data relevant to the entities; and 
reporting from the database to produce the control output, 
wherein tho entities and data concern -the following: 

tho objectives of the system arranged in hierarchies and are each. 

labelled to identify their position in the hierarchy; 

the processus of the system arrangud in hierarchies and are each 

labelled to identify their position in the hierarchy; 

the resources used to perform the processes, 

the locations, persons ami positions involved with the objectives 

processes and resources; 

the risks those processes and resources arc subject to; 
the consequences should those risks materialise, 
tho controls which mitigate the risks; and 
assessments; 

each combination of objective, process ami ri<k linked to the 
consequence, resource, control and recommendation entities 
and wherein: 

the miulysis involves the use til the t ombtuatious oi obie* tue. 
procass and risk, reporting involves a link between the consequences and 
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(lssossiiicmt outilius: 

and ^ ... 

th« control output iw:KulWn of «x|»osuivj« mul siumttrios 
which haw uu uimccwplnblo risk usso»:i«tml with thutn. 

.'2 <•> * * S i > * 
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A risk bustnl i d/i/aj/ system 



Tho lullou ini; stutomnul is <i lull description ol tlu> iiuimiIiom 
tticliiilini* thti host iv.cthtul of portni tiling it known to us: 



Tochitical Kiiilcl : i. 

This invention com tuns a uuMluui usini* u cuinputtM t(i provide risk 
based control output, In another ^^sjmh t it oyiui^rus a computer system for 
use in lisk based control. > /is ; . > I - 

Kisk is measured in tonus of the likelihood and ctmsoijuonco of am 
occurrence taking * do consideration existing ;qcMi| ; |\))uuints.uivH. Risk 
management is an i ; ut^i^;tiv^ |irtH ;ess t:cuisistin^ tit^vt^biltJtiiuoil stops which. 
It) taken in soq.uo4u:t%.sjipj^ greater 
insight into risks and their impacts Kisk management can he applied toianv 
situation whoro an org<misatiomqv ^ 

opportunities . :< . . . : ; i f . :( M. ^.^ji *r;5> h\V:i >'n ' ■ '* 
Risk .may ai;isoTit«uji^ 
15 need to bo considered when iilotstityiuj? risk.: (^avisos of risk include. the 

following: ) :i v f - . : . : , J-;;*.';.;-, : : i :' 

Natural (Delay, InUuniptiomJ-oss) includes oartluptako^lighlning,; 
strike, stonm flood and drought, ^ t ; m } ^ : 

- I huntontional ! luman Hohav iour (^ihstandard Quahtvl - imdudos 
20 error, omission and accident. ^ { ^ r^r ^ 1* ? > ^ 
Intentional J luman Huluivionr ■{ Uai<uithoi j^od^ut^), - i&cludos fraud, 
theft, riot and sabotage, , . *^c- V:,: :^;/h^-'mI:^ -^i-- 

Other sources of risk include h..^ :v ■ ■•; .: h ^ ^ ; ^ 

Technological - includos obsolescence, advances ami failure. 
25 Kconomie and Financial * includos iuUu national ov hango rates and 

domestic factors such as interest rates and uumnplovmout % i 

Kitvaroumoutal - includos ihmsik contauuihUion 4tnd pollution. 
Commercial and Logal ■> includes liability am) other contractual 
obligations, .. , \- , ■■ i '•• 

:I0 Statutory - includes censure, fine, disallowaut e and tail soutem o. 

;lVilitii:al • includos logislativo < ban 140. public pon option and -imago. 
Managt'UiciU tit risk isuut int<?gr<d part -of tho luaua^omout pan t?ss 
Risk managomout is an iterative pi:i.t«;oss » omprisin>: si\ tuain ^ 
eli*tutuits or sti^ps as follows:- i j : ^.v ! : >: : .;■ ^ - 
IIS Kstabhsh the context * This L .-str p t^stablishes tluvsti ite<iV . 

orgiinisa;,oual a\u\ risk mauageuu*ut v outext m wlm h tin* u st ot tin* pan-ess 



will take place, Criteria against which risk will ho assossiul aroVstabhshed 
ami tin? structure of the analysis is defined/ ; ' 

hUn\Ut\ risks ldonfirvAvh \i\ why anil how things can arise as the 
hasis for further analysis. ^ ^ 

Analyst) risks - Determine tho existing management controls and 
analyse risk in torms of likelihood a*! 1 consequence in tho corttoSU of those 
controls, Tho analysis ^coiiskhji^;- - > d ^'n';' h - m 

(i) how likolV is an 'ovcViit to happen? And • • i ;r; / 

(ii) w hatUi& th&poto^^ 

Tlwse elements* h&5 ti^ estimated level of 

risk- ' - f • ' ' ! i ^ » > ; 3' s** i' r.M . J . •: : /i { i '• i ^ < ' ' : : - v ^ i ' " < *" ; ' J - ; '- • i 

Evaluate risktf~€^ of rti&s aiiaiii^i iho pm-^ 1 x 

established criteria. Kisk am then ranked to identify nuuta^outetVt jnuutti^s: 
■ If the levels of risk esrtaldishod io\\\ thon risks Vnay tall into an act optuhlt 
category and treatment may not ho hnphrod • ; • ■ ! \ 

Treat risks - Accept and monitor low priority risks. 1W othtVrisks-' ; 
developed and implemented a specific numa^euunU plan \vlu< h uioiudes 
consiiloration of funding. w m 

Monitor rtud hivknv * Monitor and review tho portornKitit o iif tho risk 
management system and changes which might affot:t it. 

Tho risk management proeoss Ita& tradt lionaliy iiwl il ved -a' thon? or 
loss systematic collection of data and subsequent analysis by *vu e\pi^ioncod v 
professional to produce a ro|>orh J : v> t ; ; ? ^ 

S a unitary oflhn Invention ^ >^*- ■ r * ; * ' 

Tho prosont invention is a ihothod ot it \mg a eim^utorotpuppetf 

w ith a relational database to provide oouJrol output to address vlu thieuts 

confronting a systomor organisation, comprising the stop?' ot ^ u 

creating a series of relational database entities which des* nheihe 

system: : 'it\ ■ r -*^ 1 ; <%. v 

analysing the system tci;(hn;ivt^4iataU^doVitiU^t&i-th«^oiititiosV\'tiul 
reporting fronv -the database .to produce the rout rol output . 
whtMoiu the outtttos ami data;* oui oru tho ti»Uowiu^ 

tho obiootiv os of the system arranged -in hiokan lues aihi ai* oai h 
labelled; to identity their pv>sittou ut tho hieran h\ ; " 



the processes ot the svsteni arranged in hi* ran lues ami an* oae 
labelled to uitMUity their posnnni in the hieran hv; 
the lysouives used lo portoi m the pro* esse*, 
the Uh atii>tis, persons ami positions involved with the objective 
|niH:esses ; ajul n;st>uiyt>s, f . ; 

the risks thoso JMtocosses ami lystmjiu^aiy sublet t to; 
...... tho t ^onsoquotj^:^^ 

tho controls which mitigate the risks, and i 
,\ ; assessments*;, : ;_ f i , t ... , .. :f .... . , ^ . ; . . , ; i 

each i^m^tnatioy of objo;cti\y v pso^rss and nskjhukod to the 
consequence, rosoun y, control and iyi rounueiKtatit w^vrH itiesi ; 
ami wherein: 

the analysis involvt\s the use ot;tho couibiua tHm* «.ihjei tive, 
process ami risk, lyportini* in\ olves, a luik |uH\\ een the \ >msequtMh es ami 
assussniont tuititics; ; aiHr- ; . u-- .^.h i- * . 

the control output includes ajisjt ot th*> exposures and scenarios 
which havo an iuuiceoptahh*,risk asst»t:tatevl xvittvlheui: it. 

Tins pmvidos tho <ui vantages thai: ^ , i t ; , 
Management is able to identity those tuuetumsun; processes within a 
svstom. such as an organisation, which are dependent on specific ivsourcos 
ami thu risks which those Junctions ami n^sourv^ s ai^vsuhjt^t to- ^ 
Risk arc* evaluated an tonus t*t- }ikolihiHHi\wuii£^-iutsi % (|:ut>uc<v,:/ 
Mauagouumt is able* to identify tho most at nsk Junctions and resources. 

Risks can bo a voided* transftmmi?m part;or in t ulh or -suit ijjaUnl by 
instituting Additional controls to lower the hkehlnnxi or conseipiyncos or 
both likelihood ami cousoquonctv « 

Risks can bo properly managed and uisuiatuv risk ttuaucm^ i osts 
kopt to a minimum 

In another aspect the iuvcuttom as currontlx envisaged, is a computer 
system for-pitivnlinji control output to addivss tin* threats conirountiit a 
systeni or oi>iaius*itn>ic 1 1 inprismu / 1 ^ 

a computer equipped with a data input means, a. data privcssor tfud a 
relational database in .-which theivare -created a series u>l relational database 
entities which describe tho system; ' m r \. < ^ - ¥ 

wherein the entities and data Huu ern the iVilKnvimr ■■ " 



the oh^vtives of the sv strui aiUuiviiHl iit hieraa lues aiul are each 
labelled to blritlitv th«'ir {»os»tiiui in the hiefan hv; 
the processes of the system aruVutieit in hie van iues and an* each 
labelled to identify their position tit Ihe hierarchy; 
the resotm :es usvil tti |MMloi4ii ;,; ttu* processes; 
the Iocafiv*nsJper:!uuis aiul petitions wSth the ohfectn es 
pan esses and resources^ n ' u - l :!, ; ^ - ^ - 
the risks those pn'u esses and resonates Via* snhiect to; 
-■ the v onsietpVeuees should -tho^o i ; iskk uiaiortalVsi\ ' 

I ho. a onta*ls:\\ hiv h^utlicalt* the^isiisvat« * [J " - ■■ 'Y ^ ^ 
assessments. ; ?; h : v - 

* each i iHuhuiat^u oi ohi*« m t *ti\ v; juov ovs aud^i •isk'lfnked to the 
consequent e. resources, cYMitrol and >n*vVMuiuendatioh eutrti^sv and \\ hereim 
the pnnessor act esses tin* relational database, analysed data tvle\ ant to the 
entities- usiiu* the combinations 'ol ohiei the. pan essiiud risk*; aiui reports the 
control output using a lurk lUvtueeh the i:tnlsei|[uetu':lvaml-assl^ssuVrlt^ j iiti^n , ^ 
to produce a list of the exposures and scenarios vvluv.ii -have 'an iuku < eptahlo 
risk assiu:cvt<Hl with them -'^i ^ ' " '■■ ' ! = 5 

Hrutf Uoscrtptiot; of llm Uraniums - m', . ^ s '.th '-t 

An example oft lie, invention will -now he described wvth ivlua*neo to 

the accomp<uiying drawings, in which >v, ? ; i * -i t , ; 

Figurtv t is <£ s\ii«Miwtioili<tgi4;^4^ 4i ^otn|mU^r t<iuhixiyiuj;4lie 

invention: ami ' vr,';, f - v. -v 1 • ■/ - 5 -c. ,;> ■• 1 

Figiue J is schematic diagram t*t a relational database: used by- ihe 

invention ..y- • ' '-.t . . * ; < ; ■ : ' '\ 

Hest Mmte ot tho Iiivetitioti * ^ • <;:i-rr>r: 

Keterrw ; ig tirs' to iiguiv l. the computer? t 4\'*uwprise'S'aMlUiU r ?pV^-r\^stM--' : ' 
~\ data input means J and a tuotutoi I lu addition. there is "\\ a^lationa! 
tlataha.se. ^ >uul a pi intt*i f ; ; : : ; :&/.•*.**;.'■;;.'. 

f i'he;eatitfa*;s w itluu -the -n-ia'tional d latuhasr aiui thew a-lat^^nship • 
with each othet aie sh«*\\u in more iletail in I icuie J hetore a s\ sti ; ur v an * 
ette* ta elv h<* i'ontn»l.h ( >i.; it is uev t»ss.ar\ tiiCtrsCthhsh a uutuheV ot elements oi 
data aiatuit; tt^ \\w entities ot \he sxstt'iu. tot install* e the sxstetu or 



organisation 10. thtM>i*>:anisatuui loxiels;! lj;por^ou-l^v.^i-)sitK.ui- 13* location 14 
and pnuvss 13. t ? r ■> 1 ;.! i*. ■* ^-/* h.b; *. 

v l)jyaiusaUoivJtr\vls ; I i. refer to the lex:el of : ai\al ysts and -reporting 
* ivipitrod for tho;pt\*ject/fin^ puK o^^: dix ision branch; ; , 

: Normally thtsps dictated by the stru^^^^ 10 ami the 

>i amount of analysis reipiirodi; Jviichp unless ITvof the sy sitom is assigned an 
organisation level ^ ^ ? ^ r ^ . k v , - ; 

v ] J;; IVrson; 12 details ai^vrtnuriled oh tlunisystom^^idontit\ ^tho people 
xx^ho occupy piisitimts, J\Vwfini:iMHo in tf i<h te%u! -ut \ :v *: no ^ { ) 
: ■ i. . ; Position detivils'atx^^ tluv 
positions: i>r roles, of thfcVpdoplev V2 in;tluvoT^tuusittiun These also 
identify thea**spiNisibilitieis fc>rc processes 15; reslum es. itvaelmn oriunit of 
objectives, Iviand impltmroiitation^H^^ -? a i 

htK:atiou details a^Mveonled uht-htvsy^tbuiJo identify thtvlocation 
of the onwmsatioh! 10 and its prvH-ossos 15; pimUons ami ivsourees 1Ck 

The system maintains ohiootixe entities? IZlvx hiv h describe the 
specif icu:orpbrato vision! nrissionsrcorpoiiito goalsv strategies* and4aotics. 
Objectives - 11" aiv particularly relevant vVJieii risks 18 ;uiv ^ssesked at a^ ; 
strategic levok : j ;; , \; v = 

A process 15 may bo a group of tasks, a^efctiou M a Uopartniont. a ' 
department, a division or an prgauisat unviia a - xvlioU^/i^lnviiiiHitJSSes are 
arranged in a hierarchy \\iieroliy sub>^ 

process of xvhieh is part ' :..-t"^:&nb .ft 'Ur> m " *f L 

Risks 18 identified for assessment aiV ivH:ordekl m the system. Those 
could bo exposures or scenarios. .iv:\ i 

The analysis 10 of risks 18 is usually performed in ihe iU>utoxt of the 
objectives 17' and pixxesses 15 H'he i oiubihatious 20 of the objectives, 
princesses, ami risks are maintained as an entity m the sxstom K:sks are 
assessini 10 in the terms of their'likehhvHHj ^f Uccurreiu o, their worst ease 
impact ami their in erall loss 'con<trol -ThoV nuV also haxe at; i stwuated 
maximum potential loss quantitatneU veeorded > ^ 

Risks eau bt^ assessed 10 at a -slrateifii; le\ 'el ^peVatiou'U'l !* v iel or 
sptu tliirallv for business interruption When usks UreM'ssessed Kii a "strategie 
level, the importauee of the obioetixe is also-woii^idoieVl-'-v- ; v 

In t ht* identification and aualvsis of risks- iheu coiisi\jiieiu'es are 
reeiuxlevl in the system 1'arh v onsi\jueiu isiinkecl tv^ aiva^essiinuit 10. 



This link is essentia! to describe the out^^ happening* It also 

enables the calculation of maximum potential]^ 

Resources 10 arts tw|uu*Kt to petform^ Resources include 

people, systems \vhether manual or ^nipWws^; m 
assetso Key resources <?f a pftx^ss an*a^ 

dependence on those resource the 
.adequacy of its hackup/risk jeontrok i ^ 

' Coutrols!21>a^ poiici^^ staridartls^ahdrpitH^Klurcs to-'p*ivenU detect, 
or correct the consequences:*^, risk. : ThQ'fifftKiWyctWssiZ t of controls in the 
context* of the ohiectivei process and risk combinations 20 and the^ resources 
10 am established tto- detennine the IeretbfWsk^ Any control which is not; 
adequate will require treat-merit; This treat mailt or ^rrective action is ^ 
recorded as a n>comtnendatioti ;2li«- fThe mcommendataon holds information 
relating to the priority far eori^U\^ action, cc^^ 

(estimated and actvial); and the position 13 ^jpi^ impimnentatidn. ^ 

- To prioritise risks J the system caleiilates the level of risk by taking 
into at^coimt the assessments oX likelihood, impact and control.; and where* 
applicable, the importance ;factor of ^ the ob|ective or the level of dependence 
on a resource, ' - 

Example Miisins the system v \.vv ' ' ' : . 

, ; ; ^ payroll services 

bur^tf^^ \ ■ -j y 'i : : - 

jsinarketiaig division; and 
payroll serv ices dixision. 
: TTlie Company's ob^ctives include; ; 
beitig the jeaditig provider i of payroll services which it ho|>os to 
accomplish by: ^ > ^ ^ 1 - • 

capturing 90% of the market by AgKMfc 
providing quality sen- ices toils, clients: and ■ / » 

providing an excellent, work environment . . 
The risk scenarios for Total Personnel Sen* ices- include: 
business interruption: 1 
delay interruption loss: \< 
errors; and omissions: ; ( i 
, tVlilui>\to f achieviVi4Mective:r. ' 



"... fire: . ^; ; -.v- --v -• • \ • " " ':• ; 

flood/water damage: and 

cotttractuaUiabUity. J 
The processes for the Payroll Sendees Division include: 
5 - dient liaison; - ^^•^Sx.^. . /^v^'.;. { | 
computer operations; and^w 1 
computer progranumtigv! 

The key resources required by the l v ayroli Sorviavs Division to 
perfonn its processes include; ., ! ■" 

10 PC Pay* System 7 " ^ j ^ 

PC Sem>r/Tennmals/Printer i I 

Key Personnel •■ 
Office Facilities. \ 
Each abjective is assessed as to its operatiqnalvrisk. strategic risk and 

15 combined risk r A raw score and an average score are calculated as follows: 




1 1 

The ke\ iesouive< ait* then a**es>'*d a> to -tho de| « * th,« 
Pawoli Services ptw:es*es an thettu the likehhtH*d at the :< *-u:v* > ivuicio. 
or becoming unavailable, the statu* of t*u< kup mk * outjoi uui the pn* tt!\ 
tot business uvovery planning. 

Giue assessed, a number of reports can be pnxlui i : i the»e 
tvpoits i* the Key Resources at Risk a'|*>rt which show* 

ie$ource descriptions 

functions or processes which use the ivsoutve 

level of depeudeiukv likelihood, and backup tt*k < ;outu*i : 
calculated tiuancict usk factors. de|teudeiu v mk ta* tm> and ^ 
buMtiess nxovery planning priout\ factors expressed in rum 4 :u \ iv,: ^ 
f*eiveutage /• 7 S ; ~* 

The key controls which mitigate (prevent, detect or v iuir\ t j the., 
cousequeuees of the risk are then euteivd tuto the m^m a^au^t *\u h • 
ivsoutve ami exposure These arc assessed as to its curtvut etks uvvness to 
mitigate the risk When* the control is tidt effeetrit* (ie Hxudethue' ot i : 
"inadequate'* or *noti-existent m |, the corrective action is also n voided 

A number of reports can be produced from the system These , 
include : • S 

(i) A Risk Mitigation Report which shows; 

ptucess«i and related ropuffurcs*. resource* and . 
; consequences with calculated hkehhood impact. con!^>t 
estiuwttxi riajdmui^ IKileiitiil lossl calculated lejAVl of risk 
or residual risk and estimated costs, 
(it) Workpaper of Key Controls. Risk Assessment and i\»ni\ Uve 
Action which shows; 

ptxxtesses and related exposures and ivs^uiv e> with 
calculated liketthitod. impact, control: . at:w !;ve at. turn, 
pnontw |H>sitiotv responsible to implement i evtimiated 
and actual costs 
tin) l^ousequences of Interruption - overview oi : ; v :-<>o> 
cumpod by level bv piwess. whvh >how% 

; : tvsouices used bv each puv e>\ and sit! \ : . w;*h i'u* ; 
entical peril vi the tesouue is lequued n*; 
the dailx a:;d maximm.: - . >: w - mi; -j v. - * 



th<M>stiui<ittul time tii tosttuti iho tosoujt o. 
tluvtvstiuhtUul loss c ^jnaikottit luvtuiut'. 
Ihu o$titn<U<id loss of jMUjHMtv #, i i it 1 1 mio hi . 

ft Individual MPhot o«u;h jmn oss, and tituihtUat risk factors 

, , . in curwi)c^Md as ft |um:ooui)v^ , , nl 
Although Jh© invention . h<v* .Jwwn t lt\st :r il »t u t ^xvi 1 1 1_ tvhM^M^v* 11 <t 
Imsiuuss organisation «m*L iIm^ S» i > > I**** ,,is °' M^'UjlMM th«t(,ttt^<iuis^tiiiu it 
- should bu aniMl^atad that tha iuva.utio.il could 1 |>i \'« * ; u i > 1 1 1 i« ui t.i<> 1 1 to othar 
10 kinds of svstmns, For instance, tho invention could 1m> <mnIiod to tho 

m<tiiitt*u<m£6 6( sophisticated nicuu* oi niatdiinorv such as a nowtn station. 
Tlio at* joe t i vgs } i\ this ,C«s« ivil^htjn? U* utaiiitain |ii\hI iiv.tHiii within a 
8iHH^fiod range* and, tiif|^i.sks.^.tii^U|. ||M;!uilv .j(«\«j^nv_n ol pai licuhu i tains of 
The Qqiilrol , q\i t put ^iiiigh t ha i^ha j>a>visiui» ul sarvtua nt|tui1s. and 
1ft tho htvttittion could autoinaticrtlly switch to au : \ili(irv •M|ui|Hnout whan tha 
risk of t:«nliu(jud oparation of any • \)\^\ M(.- < iy.nM'*M.V t W} i»»*Hn^ak too high, 
It will ha anprociatad .by ^ |)Mf^o.ns skilltui iu th<> ai-Uhatjiuininxtus 
variations and/or modifications nmy.hu nmda tu llta (uvanUqu iis showu in 
tha spociik; oinbodiments without dnpartin>t iituu tlx' spirit or scopo of tha 
20 iuvaution ,a,s broadly d^scrihadv |tn?saut t>}til^tli^i^u|j^ : 4ii^ tha»t»foiu. to 
Imi considarad iivali respacts as^ustmiiv^ ajitl not tasilrictiva; t: 



THE CLAIMS DKFININC TIIK INVENTION ARE AN EOIXOYY\S> 
1. A method of using a computer otpiipjuul with a rolalioitul database to 
provide control output to add ross tlio throats confronting a system or 
organisation, comprising the stops of: 

creating a seiles of relational database biitities which describe the 

system; 

analysing the system to derive data relevant to the entities; and 
'reporting from the database to prikluOb the control output; 
wherein the entities and dhta concern the 

the objectives of the system tifraujfjed in hierarchies and aw each 
labelled to id 

the "processes of the system erraiiged in hierarchies and are biieh 
' 4 labelled to ^entity their position in the hif jrarchy; ; 

the resourc^^ ^ 5 

(h« locations/poisons and posiUons involv«(l\vith thu objoctivos 
pimesaes and resources; ; ' - r - : -~ . 

the risks those processes and resources are subject to; 
the consequences should those risks materialise; 
the controls which mitigate the risks; and 
assess ments; '' r ' " " : ; ' ' ' : ' " ! " i - 
^ ? *ieh combination of objective, process and risk linked to the 
consequence, resource, control and reeommendation entUios; 

and wherein: " 

the analysis involves the use of the combinations of objective, 
process and risk, reporting involves a link between the consequences and 
assessment entities; 
and 

the control output includes a list of the exposures and scenarios 
which have an unacceptable risk associated with them, 

2. A computer system for providing control output to address the 
threats confronting a system or organisation, comprising: 

a computer equipped with a data input moans, a data processor and a 
relational database in which there are created a sorites of relational database 
entities which describe the system; 
wherein the eutities and data concern the following; 



thu objectives of the system arranged in hierarchies and aro each 
labelled to identify their position in the hierarchy; 
the processes ol the system arranged in hierarchies utut am each 
labelled to identifyjfteir position in the hierarchy; 
the resources used to perforin the processes: 
J ; r ' ; Uto : locations, piiHi»ii^linci' positions with 'tite 5 objectives 
• ''• <ly \- iut>ees^eseiulW^ " ■- ;f »s"« ^ * . ' ■•■ • .• 

, .-v ?■» m iHo'Visks those > jumeslies ; and resources^? subject to; ; 

- ? • ^flio uonstWptences slibvild those 'rUks : ihfflArial&arn - ! r ^ ^ 
'the" i^ntr^WWh^ch : ''n^i't^tQ tltetiiWttiifl^****''^'' ; ' - ' 

1 ' -- u ^ ; eiich coinhinatibn of ohjechve?piikess ? «ncf i^fek linked to the 
consetpi^hcorr^soUreesV control and recommendation ^«Hties; ° n - : 
and wherein the processor ! ckc<£oflf^o¥ v tli4i' rQlaSi«^at4ii F cliv<^li«i^ai Aiialysoa data 
relevant t'6 'Uiii %i«iii|f 'iho 'TOiiibiiittli'tmr of ©Uibetti 4 ©. process and risk; | 
and reports the control diUpitt usitig a Mftk l>et\veeh Uie^bnsequoiice and • 
assessment entities to product) a list of the exposures and scenarios which 
have au unacceptable risk associated with them. 

3. A method of using a computer equipped with a relational database to 
provide control output to address the threats confronting a system or 
organisation substantially as described Willi reference to the (drawings and . 
example. 

4. A computer system for providing control output to address the 
threats confronting a system or organisation substantially as tir libml with 
reference to the drawings and example. 
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This invewtipii cQiijt^riis a moUiottusing a coinputor io providu risk 
based control output. In another aspect it: concerns: ac©^ 
use in risk based cont wl« v Hot h the mot hod and svslom require a relational 
database to piwid^ctmtrol output to ad^r$$s.the 1 1 mm ^confronting a 
system or organisation |?A .series of relational; i^|kilia||»Q^it|es^vliU:h 
describe the system are created. The system is analysed to derive data 
relevant to the j ^UU^ v Jj(i9;ajuajysi^ < jij|w|\'Q9 thojuse of the coinbinations of 
objective. process «nd ; rislv ; A. report is ; obtained fpm IheMlatabase to . : 
pro(luco a control outpuU JhUittijiJort inmlyes % link betyveon the *:<rhwi 
conse^ueuces aiMl.ftssQSsmant entities. The contrtil output includes a list of ? 
the exposures and scenarios \y)dch with 

themv; , ; ; if , v / ■■...•?.•:..?.■;■;..< ;\r* , ■■ ; \ i., y.. . •'»> ..; i ; ; ; J > y-y> 
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